Financial fraud risk evaluation method and device

Abstract

The invention relates to the field of risk assessment, in particular to a financial fraud risk assessment method and device. The method mainly comprises the steps of performing semantic analysis on a sample by using a large language model to obtain business semantics of the sample, and obtaining potential risk characteristics and a suggestion analysis method of each variable in the sample based on the business semantics; and generating distribution characteristics of each variable in the sample by using a large language model, obtaining an anomaly detection rule of each variable according to the potential risk characteristics and the distribution characteristics, establishing an evaluation model based on the potential risk characteristics and the anomaly detection rule, and evaluating the to-be-analyzed data by using the evaluation model according to a suggestion analysis method. According to the method, semantic analysis can be carried out on the sample and the to-be-analyzed data by using the large language model, the risk assessment indexes are obtained based on semantics according to the analysis result, and construction, optimization and assessment of the assessment model are assisted, so that the accuracy and efficiency of financial fraud detection are improved.

Description

Technical Field

[0001] The present invention relates to the field of risk assessment, and in particular to a method and device for assessing financial fraud risk. Background Art

[0002] With the rapid development of financial business, financial fraud risk management has gradually become a key area of ​​concern in the industry. In order to assess the credit risk of customers and the compliance of transaction behaviors, evaluation models are widely used as important tools in financial risk control. The construction of traditional evaluation models usually includes steps such as data preprocessing, indicator pool construction, univariate analysis, multivariate analysis, module integration, and model evaluation. However, the process of univariate analysis and multivariate analysis is complicated, and analysts are often required to manually extract variable information from a large amount of data, verify the relationship between variables, and the correlation with the target variable. This work is time-consuming and labor-intensive, and is easily affected by human factors, resulting in inefficiency and unstable results.

[0003] In addition, during the evaluation phase of the evaluation model, it is necessary to conduct a comprehensive evaluation of the performance of the evaluation model, such as accuracy, recall, model evaluation indicators, etc., and explain the prediction results of the evaluation model. This process requires professional model knowledge and complex data analysis capabilities, especially when processing massive financial data. The complexity of the task is further increased, becoming an important bottleneck in the construction of the evaluation model.

[0004] In view of this, how to overcome the defects of the existing technology and solve the problem of complex evaluation model construction in financial fraud risk assessment is a problem to be solved in this technical field. Summary of the invention

[0005] In view of the above defects or improvement needs of the prior art, the present invention solves the problem of complex evaluation model construction in financial fraud risk assessment.

[0006] The embodiment of the present invention adopts the following technical solution:

[0007] In a first aspect, the present invention provides a method for evaluating financial fraud risks, specifically: using a large language model to perform semantic analysis on samples to obtain the business semantics of the samples, and obtaining the potential risk characteristics and recommended analysis methods of each variable in the samples based on the business semantics; using a large language model to generate the distribution characteristics of each variable in the sample, and obtaining anomaly detection rules for each variable based on the potential risk characteristics and distribution characteristics; establishing an evaluation model based on the potential risk characteristics and anomaly detection rules, and using the evaluation model to evaluate the data to be analyzed according to the recommended analysis method.

[0008] Preferably, the use of a large language model to perform semantic analysis on the sample to obtain the business semantics of the sample, and obtaining the potential risk characteristics and recommended analysis methods for each variable in the sample based on the business semantics, specifically includes: using a large language model to perform semantic analysis on the sample to obtain a feature vector for each variable in the sample; wherein the feature vector includes a data type, distribution characteristics, and business semantics; matching the feature vector with a knowledge base in the corresponding field to obtain a risk score for each variable; obtaining potential risk characteristics based on the risk score and business semantics, and obtaining a recommended analysis method based on the data type and distribution characteristics.

[0009] Preferably, obtaining the risk score of each variable specifically includes calculating the risk score using the following formula:

[0010]

[0011] Among them, VURI (v i ) is the variable v i The risk score, v i is the variable currently used for risk scoring; γ and ζ are constants used to adjust the risk score; δ(v i ) is the variable v i The outlier index relative to other variables, η is the offset constant to ensure the stability of the calculation; λ(v i ) is the variable v i The strength assessment value of the corresponding data type; ξ is the matching weight of the matching items in the knowledge base of the corresponding field to the overall risk; Is a matching function, the return value of the matching function is the variable v i The matching strength in the knowledge base of the corresponding domain, It is a knowledge base in the corresponding field.

[0012] Preferably, before using the large language model to generate the distribution characteristics of each variable in the sample, the method further includes: obtaining original data from the data file and metadata information, calculating the harmony of the original data, cleaning the original data according to the harmony, and using the cleaned data as a sample; wherein the harmony of the original data is calculated using the following formula:

[0013]

[0014] Where DHI is the harmony of the original data; n is the total number of original data; x i is the i-th sample in the original data set; φ is the adjustment item for the business corresponding to the variable; θ is a constant used to adjust the harmony metric level; ψ is used to emphasize the sample x i The power coefficient of the degree of influence in harmony.

[0015] Preferably, the use of a large language model to generate the distribution characteristics of each variable in the sample specifically includes: using the large language model to parse the variable name and business semantics of each sample, performing statistics on the sample based on the variable name and business semantics to obtain the skewness and peak value of each variable, and obtaining the distribution characteristics of each variable based on the skewness and peak value.

[0016] Preferably, the method of obtaining anomaly detection rules for each variable based on potential risk characteristics and distribution characteristics specifically includes: obtaining anomaly value intervals for each variable according to potential risk characteristics and distribution characteristics; and obtaining anomaly detection rules for each variable according to anomaly value intervals and business semantics.

[0017] Preferably, the data to be analyzed is evaluated using an evaluation model according to the recommended analysis method, specifically including: obtaining the business semantics of each variable in the data to be analyzed through a large language model, and comparing the variables with the anomaly detection rules in the evaluation model according to the recommended analysis method corresponding to the business semantics; if there is at least one type of variable that meets the anomaly detection rules, the data to be analyzed is at high risk; if there is no type of variable that meets the anomaly detection rules, the data to be analyzed is not at high risk.

[0018] Preferably, after establishing the evaluation model based on potential risk characteristics and anomaly detection rules, it also includes: generating virtual fraud samples using a large language model based on historical fraud samples and specified fraud scenarios, adding the virtual fraud samples to a sample set to perform slight perturbations on samples in the sample set to generate adversarial samples; using the adversarial samples to test the evaluation model, optimizing the large language model based on the test results, and using the optimized large language model to re-establish the evaluation model to generate a more accurate evaluation model.

[0019] In a second aspect, the present invention provides a device for evaluating financial fraud risk, specifically comprising at least one processor and a memory, wherein the at least one processor and the memory are connected via a data bus, and the memory stores instructions that can be executed by the at least one processor, and after the instructions are executed by the processor, they are used to complete the method for evaluating financial fraud risk in the first aspect.

[0020] In a third aspect, the present invention further provides a non-volatile computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are executed by one or more processors to complete the method provided in the first aspect.

[0021] In a fourth aspect, a chip is provided, comprising: a processor and an interface, for calling and running a computer program stored in the memory from a memory, and executing the method provided in the first aspect.

[0022] According to a fifth aspect, a computer program product comprising instructions is provided. When the instructions are executed on a computer or a processor, the computer or the processor executes the method provided in the first aspect.

[0023] Compared with the prior art, the beneficial effects of the present invention are: by utilizing the powerful natural language processing and semantic understanding capabilities of large-scale language models, using large language models to perform semantic analysis on samples and data to be analyzed, and obtaining risk assessment indicators based on semantics according to the analysis results, assisting in the construction, optimization and evaluation of evaluation models, so as to improve the accuracy and efficiency of financial fraud detection, and is widely applicable to scenarios such as financial risk management, anti-fraud systems and intelligent decision support. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 A flow chart of a method for evaluating financial fraud risk provided by an embodiment of the present invention;

[0026] Figure 2 A flow chart of another method for evaluating financial fraud risk provided by an embodiment of the present invention;

[0027] Figure 3 A schematic diagram of a specific analysis report of potential risks of variables in a certain scenario of an embodiment of the present invention;

[0028] Figure 4 A flow chart of another method for evaluating financial fraud risk provided by an embodiment of the present invention;

[0029] Figure 5 This is a schematic diagram of an analysis report of variable distribution characteristics in a certain scenario of an embodiment of the present invention;

[0030] Figure 6 A flow chart of another method for evaluating financial fraud risk provided by an embodiment of the present invention;

[0031] Figure 7 A schematic diagram of the structure of a financial fraud risk assessment device provided by an embodiment of the present invention;

[0032] The reference numerals are as follows:

[0033] 11: processor; 12: memory. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0035] The present invention is an architecture of a specific functional system, so the specific embodiments mainly illustrate the functional logical relationship between the various structural modules, and do not limit the specific software and hardware implementation methods.

[0036] In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other. The present invention will be described in detail below with reference to the accompanying drawings and embodiments.

[0037] Embodiment 1:

[0038] In recent years, the development of pre-trained large-scale language models (LLMs) has brought new technical possibilities for the construction of evaluation models for financial fraud risks. Large language models have powerful natural language processing and data understanding capabilities. They can efficiently process unstructured information in financial data, mine complex relationships between variables, and generate analysis and interpretation results that are understandable to humans. In univariate analysis, large language models can quickly analyze the distribution of variables, outliers, and their relationship with target variables through semantic understanding; in multivariate analysis, large language models can be used to process high-dimensional nonlinear relationships between variables, automatically generate highly correlated variable combinations, and significantly simplify the workload. In the evaluation stage of the evaluation model, large language models can automatically generate natural language reports to explain the performance indicators of the evaluation model, and conduct in-depth analysis of abnormal situations, reducing the complexity of analysis and improving efficiency and accuracy.

[0039] In this embodiment, a method for evaluating financial fraud risk based on a large language model is provided, which optimizes the core steps of potential risk characteristic identification, distribution characteristic and outlier analysis, sample enhancement, etc. in the evaluation model construction process, realizes the simplification and intelligence of the evaluation model construction process, greatly reduces the technical threshold, and provides an efficient and reliable solution for financial risk management.

[0040] like Figure 1 As shown, the specific steps of the financial fraud risk assessment method provided by the embodiment of the present invention are as follows:

[0041] Step 101: Use a large language model to perform semantic analysis on the sample to obtain the business semantics of the sample, and obtain the potential risk characteristics and recommended analysis methods for each variable in the sample based on the business semantics.

[0042] In order to establish an evaluation model, it is necessary to first analyze the existing samples in each business scenario. In actual implementation, the data tables and related metadata files used in the actual business can be parsed to obtain the actual business data and its attached variable names or context descriptions, etc., and the variables are generated after the data format is unified, and samples are extracted from the obtained variable set. The variable set can be defined as:

[0043] D = {v1, v2, ..., v n},v i =(n i , t i , c i );

[0044] Where D is the variable set, v i is the i-th variable, n i For variable v i The variable name, t i For variable v i The variable type, c i For variable v i Context description.

[0045] After obtaining the variable set, samples can be extracted from the variable set according to actual needs. After completing the sample extraction, the obtained samples can be combined into a sample set for subsequent use.

[0046] The evaluation model needs to include the potential risk characteristics of each variable. In the prior art, it is necessary to manually analyze the data tables related to financial business, extract variables from the data tables through various statistical tools or mathematical tools, and analyze the potential risk characteristics of the variables. In the method provided in this embodiment, there is no need for manual analysis. Instead, a large language model is used to perform context-related semantic analysis on the data table and other related data, and the potential risk characteristics are extracted based on the semantics of the variables. In actual implementation, the potential analysis characteristics are obtained based on the business semantics of the variables. For example, when the variable is the number of transactions, the potential risk characteristic is high-frequency trading.

[0047] On the other hand, since different variables have different distribution characteristics, different analysis methods need to be used according to each distribution characteristic when conducting financial risk assessment. Since the large language model can realize data statistics, the distribution characteristics of the variables can be obtained through the large language model, and the recommended analysis method can be obtained according to the data type, distribution characteristics and business semantics of the variables. For example, when the variable is a continuous normal distribution, the recommended analysis method is standardization.

[0048] Step 102: Use the large language model to generate the distribution characteristics of each variable in the sample, and obtain anomaly detection rules for each variable based on the potential risk characteristics and distribution characteristics.

[0049] When conducting financial risk assessment, the outliers and distribution characteristics of different variables are different, so the anomaly detection rules are also different. For example, the anomaly detection rule for customer age is to conform to the actual age distribution characteristics in the business scenario. When the customer age is too young or too old, it is detected as an outlier; the anomaly detection rule for the number of transactions is greater than the number threshold within a specified time period. When the sum of the values ​​of the transaction number variable within the specified time period is greater than the number threshold, it is detected as an outlier. In the prior art, it is necessary to manually obtain the anomaly detection rules for each variable according to the business semantics. In this embodiment, since the large language model can perform semantic analysis, there is no need for manual analysis. The range of outliers can be directly obtained based on the statistical results of the large language model, and the anomaly detection rules can be obtained based on the semantic analysis results and the anomaly values.

[0050] Step 103: Establish an evaluation model based on potential risk characteristics and anomaly detection rules, and use the evaluation model to evaluate the data to be analyzed according to the recommended analysis method.

[0051] After obtaining the potential risk characteristics and anomaly detection rules of all variables, as well as other characteristics such as data types and distribution characteristics, an evaluation model for financial fraud risk can be established so as to evaluate the data to be analyzed according to the evaluation model. In this embodiment, when analyzing the actual data to be analyzed, the large language model can also be used to perform semantic analysis on the data table to be analyzed, obtain the business semantics of each variable, and compare the business semantics with the corresponding potential risk characteristics and anomaly detection rules in the evaluation model, and judge the degree of financial fraud risk of each variable according to the comparison results. Specifically, the business semantics of each variable in the data to be analyzed is obtained through the large language model, and the variables are compared with the anomaly detection rules in the evaluation model according to the recommended analysis method corresponding to the business semantics; if there is at least one type of variable that meets the anomaly detection rule, the data to be analyzed is at high risk; if there is no type of variable that meets the anomaly detection rule, the data to be analyzed is not at high risk.

[0052] After steps 101 to 103 provided in this embodiment, the evaluation model can be constructed based on the semantic analysis results of the large language model, and the evaluation model can be used to complete the evaluation of financial fraud risks.

[0053] like Figure 2 As shown, the sample can be semantically analyzed using a large language model in the following manner to obtain the business semantics of the sample, and the potential risk characteristics and recommended analysis methods of each variable in the sample can be obtained based on the business semantics.

[0054] Step 201: Use a large language model to perform semantic analysis on the sample to obtain a feature vector for each variable in the sample.

[0055] In actual implementation, a large language model can be used to perform semantic analysis on the variable name and context description of the sample to generate a feature vector for each variable:

[0056] f(v i )=LLM(n i , c i );

[0057] Among them, f(v i ) is the variable v i The feature vector of LLM(·) indicates the use of a large language model for semantic analysis. i For variable v i The variable name, c i For variable v i Context description.

[0058] In actual implementation, the feature vector can be determined according to the analysis needs. In general scenarios, the feature vector includes: 1. Data type, such as continuity, discrete, etc.; 2. Distribution characteristics, such as skewed distribution, normal distribution, etc.; 3. Business semantics, such as amount, time, behavior, etc.

[0059] Step 202: Match the feature vector with the knowledge base of the corresponding field to obtain the risk score of each variable.

[0060] Since each variable may belong to a different field, it is necessary to match the feature vector of each variable with the domain knowledge base to determine whether it is a potential risk variable. In this embodiment, the risk score of each variable is calculated based on the matching degree between the feature vector and the domain knowledge base to achieve quantitative assessment of financial fraud risk. In specific implementation, the risk score can be calculated using the following formula:

[0061]

[0062] Among them, VURI (v i ) is the variable v i The risk score, v i is the variable currently used for risk scoring; γ and ζ are constants used to adjust the risk score; δ(v i ) is the variable v i The outlier index relative to other variables can be obtained based on the clustering results of the variables; η is the offset constant to ensure the stability of the calculation; λ(v i ) is the variable v i The matching strength assessment value of the corresponding data type, in order to have a minimum basic value for calculation in the case of zero strength, adds a basic offset of 1 to the strength assessment value of each variable; ξ is the matching weight of the matching item in the knowledge base of the corresponding field to the overall risk; Is a matching function, the return value of the matching function is the variable v i The matching strength in the knowledge base of the corresponding domain, It is a knowledge base in the corresponding field.

[0063] In the above formula, the matching strength evaluation value λ(v i ) reflects the impact of variable type on the score, providing a basic weight for subsequent matching and risk scoring. The matching strength assessment value can be obtained through a combination of multiple factors based on the data type of the variable, including: standard deviation, variance, entropy, time correlation, skewness, kurtosis, knowledge base matching, etc. In actual implementation, numerical variables mainly rely on standard deviation, variance, and similarity, categorical variables mainly rely on entropy and similarity, time variables mainly rely on time correlation and similarity, and text types mainly rely on similarity.

[0064] In the above formula, the matching function It is necessary to comprehensively consider the variable characteristics and the multi-dimensional information in the domain knowledge base, especially the semantic characteristics, statistical distribution and abnormal situation detection of the variables, which can be expressed by the following formula:

[0065] ∈(v i , K) = α·Sim(v i , K sem )+β·Norm(v i , K stat )+γ·Outlier(v i , K anomaly );

[0066] Among them, Sim(v i , K sem ) is the representation function of the semantic similarity part. Through natural language processing technology, the semantic similarity between the variable name and information and the domain knowledge base is quantified to reflect the variable v i With the semantic knowledge base K sem The matching degree of the semantic description, this function embeds the variable v through the embedding model (such as BERT, GPT) i and knowledge base K sem Converted into a vector, in specific implementation, cosine similarity can be used to complete the quantitative calculation. Norm(v i , K stat ) is the representation function of the matching part of the statistical distribution, by using the variable v i The standardized value (i.e., Z score) indicates the degree of deviation to reflect the variable v i Whether the numerical characteristics of stat Outlier(vi , K anomaly ) is the representation function of the anomaly detection part, which returns the anomaly score based on the outlier detection method - interquartile range rule and density estimation to reflect the variable v i Whether it is anomaly knowledge base K anomaly Identify as an outlier or potential risk factor. α, β, γ are weight parameters, which respectively represent the contribution of semantic similarity, statistical distribution matching and anomaly detection in the final matching value. They need to be adjusted at any time according to the results during use, and α+β+γ=1 needs to be satisfied.

[0067] If the risk score of a variable is higher than the specified threshold, it means that it has a high degree of match with certain high-risk conditions, such as more outliers or meets specific anomaly types, and it is marked as a "high-risk variable"; if the risk score of a variable is lower than the specified threshold, it means that it does not directly match the high-risk conditions, and it is marked as a "normal variable".

[0068] Step 203: Obtain potential risk characteristics based on risk scores and business semantics, and obtain recommended analysis methods based on data types and distribution characteristics.

[0069] After the evaluation is completed, for high-risk variables, the corresponding potential risk characteristics can be obtained according to the matching results of business semantics and knowledge base. For example, the potential risk characteristic of the transaction number variable is high-frequency trading.

[0070] On the other hand, it is also necessary to obtain recommended analysis methods based on business semantics, data types and distribution characteristics. For example, the data type of the transaction number variable is discrete, and the distribution characteristic is discrete distribution. Since its potential risk characteristics need to be calculated and evaluated based on time periods, the recommended analysis method is time series analysis.

[0071] After completing the above process, an analysis report containing variable names, data types, distribution characteristics, potential risk characteristics, and recommended analysis methods can be generated and stored as an intermediate file for use in subsequent evaluation model building. Figure 3 As shown, it is an analysis report in an actual scenario, which includes three variables: transaction amount, user age and number of transactions. Among them, transaction amount is a high-risk variable, and its potential risk characteristic is the matched high-risk condition "abnormal amount fluctuation"; customer age is an ordinary variable with no potential risk characteristics; number of transactions is a high-risk variable, and its potential risk characteristic is the matched high-risk condition "high-frequency transactions may involve fraudulent behavior".

[0072] When conducting financial fraud risk assessment, the potential risk characteristics of each high-risk variable can be tested. When the characteristics of one or more variables match the potential risk characteristics, it indicates that the data to be analyzed has a higher risk of financial fraud.

[0073] After step 201 and step 202 provided in this embodiment, the potential risk characteristics and the recommended analysis method of each variable can be obtained.

[0074] The large language model can automatically generate distribution statistics for each variable, such as mean, median, standard deviation, etc., and generate corresponding visualization charts, such as histograms, box plots, etc. At the same time, using the contextual analysis capabilities of the large language model, it is also possible to detect outliers, outliers, and possible data entry errors in the sample. For example, "negative transaction amount" or "age beyond a reasonable range" appearing in a certain variable will be marked as an outlier by the large language model, and correction suggestions or elimination plans will be given. Therefore, in this embodiment, the large language model can be used to obtain the distribution characteristics of the sample, as well as the outliers of each variable.

[0075] In a specific implementation, the original data is obtained from the data file and metadata information, the harmony of the original data is calculated, the original data is cleaned according to the harmony, and the cleaned data is used as a sample.

[0076] The following formula is used to calculate the harmony of the original data:

[0077]

[0078] Where DHI is the harmony of the original data; n is the total number of original data; x i is the i-th sample in the original data set; i is the variable number value. In actual implementation, in order to avoid the denominator being zero when the 0th variable is in place and to reduce the impact of some items on the sum as the i value increases, an offset of 1 is set for the variable number value i; φ is the adjustment item for the business corresponding to the variable; θ is a constant used to adjust the harmony metric level; ψ is used to emphasize the sample x i The power coefficient of the degree of influence in harmony.

[0079] After data cleaning is completed, the large language model can be used to generate the distribution characteristics of each variable in the sample. Specifically: Use the large language model to parse the variable name and business semantics of each sample, perform statistics on the samples based on the variable name and business semantics to obtain the skewness and peak value of each variable, and obtain the distribution characteristics of each variable based on the skewness and peak value.

[0080] In specific implementations, a large language model can be used to parse variable names and context semantics to obtain data statistical characteristics such as mean, variance, and skewness, and then obtain the distribution characteristics of the variables based on the data statistical characteristics.

[0081] In general financial business scenarios, the variable distribution characteristics are usually normal distribution, skewed distribution, exponential distribution, etc. Therefore, skewness and kurtosis can be selected as statistical characteristics when obtaining distribution characteristics. Skewness and kurtosis can be calculated as follows:

[0082]

[0083] Among them: Skewnss is skewness, Kurtosis is kurtosis, x i is the value of the i-th sample in the specified variable, μ is the mean of all samples in the specified variable, σ is the standard deviation of the sample set of the specified variable, and n is the total number of samples of the specified variable.

[0084] According to the statistical properties of each distribution, when skewness < 0, it is a left-skewed skewed distribution or exponential distribution; when skewness = 0, it is a normal distribution or uniform distribution that is relatively evenly distributed on both sides of the mean; when skewness > 0, it is a right-skewed skewed distribution or exponential distribution. When the kurtosis is 1.8, it is a uniform distribution, when the kurtosis is 3, it is a normal distribution or a skewed distribution, and when the kurtosis is 6, it is an exponential distribution. Therefore, by combining skewness and kurtosis, the distribution characteristics of the variable can be obtained.

[0085] like Figure 4 As shown, the anomaly detection rules for each variable can be obtained according to the potential risk characteristics and distribution characteristics in the following way.

[0086] Step 301: Obtain the abnormal value interval of each variable according to the potential risk characteristics and distribution characteristics.

[0087] Based on the distribution characteristics, combined with anomaly detection rules and semantic information, the detected anomaly value of each variable can be obtained. For example, if a variable is a continuous normal distribution, its normal value interval can be defined as: [μ-kσ, μ+kσ]. In general scenarios, the value of k is usually 3, and the interval outside the normal value interval is considered an anomaly interval.

[0088] In some scenarios, the values ​​of some variables are discontinuous or need to conform to the specifications of the actual business. Therefore, it is also necessary to combine the large language model to parse the business semantics of the variables and determine the abnormal value range based on the business semantics. For example, the value of the transaction amount variable must be a positive value, so (-∞, 0] is used as the abnormal value interval of the transaction amount variable.

[0089] Step 302: Obtain anomaly detection rules for each variable according to the abnormal value interval and business semantics.

[0090] After obtaining the abnormal value interval, the abnormal detection rule for each variable can be obtained according to the abnormal value interval and business semantics. For example, when the abnormal value interval is [μ-kσ, μ+kσ] and the variable distribution characteristic is normal distribution, the abnormal detection rule is: x∈[μ-kσ, μ+kσ]; the abnormal detection rule is: when the variable value x meets the rule, it is a normal value; when the variable value x does not meet the rule, it is an abnormal value.

[0091] After completing the above process, an analysis report containing distribution characteristics, statistical characteristics and outliers can be generated and stored as a file or database for subsequent use in establishing an evaluation model. Figure 5 The following is an analysis report for a real scenario, which contains the analysis results of two variables: transaction amount and transaction number.

[0092] When conducting financial fraud risk assessment, anomaly detection rules can be used to determine the number of outliers contained in each variable. When there are too many outliers in one or more variables, it indicates that the data to be analyzed has a higher risk of financial fraud.

[0093] After step 301 and step 302 provided in this embodiment, anomaly detection rules for each variable can be obtained.

[0094] In actual implementation, for some new financial fraud methods, historical data may be less, resulting in fewer samples for building an evaluation model. Therefore, in the method provided in this embodiment, virtual fraud samples are generated through a large language model, including text samples and numerical samples, which are used to expand the sample set used when building an evaluation model, so as to improve the diversity of training data when samples are scarce.

[0095] In addition, the pre-trained large language model may have parsing deviations in certain specific scenarios. Therefore, in the method provided in this embodiment, a large language model is used to simulate a specified fraud scenario, and the robustness and adaptability of the large language model are tested by generating adversarial samples, so as to provide a guarantee for the large language model to deal with new fraud behaviors that may occur in the real environment.

[0096] like Figure 6 As shown, sample expansion and detection optimization of large language models can be completed in the following ways.

[0097] Step 401: Generate virtual fraud samples using a large language model based on historical fraud samples and specified fraud scenarios, and add the virtual fraud samples to the sample set.

[0098] Probability distribution algorithm for generating virtual fraud samples using large language models:

[0099] P(X|C)=LLM(X, C, θ);

[0100] Where: P(X|C) is the probability distribution of virtual fraud samples, X is the generated virtual fraud samples, C is the historical samples and domain constraints, such as amount range, time distribution, etc.; LLM(·) represents the probability distribution of virtual fraud samples generated using a large language model, and θ is the parameter of the large language model.

[0101] In specific implementation, historical fraud samples and characteristic conditions, such as transaction amount distribution, time characteristics, etc., can be input into the large language model, and then the large language model can be called to generate virtual fraud samples through semantic understanding. For ease of use, the feature vector of the generated virtual fraud sample can be extracted and stored.

[0102] In order to make the generated virtual fraud samples more consistent with the actual scenario, the virtual fraud samples can also be dynamically adjusted according to the rules of the specified fraud scenario:

[0103] X i =f scenario (X, R);

[0104] Where: X i is the virtual fraud sample after dynamic adjustment; f scenario is a scenario simulation function. In actual implementation, the characteristics of the current scenario can be modeled to obtain the corresponding scenario simulation function. X is the virtual fraud sample before dynamic adjustment. R is the rule parameter, such as transfer frequency, geographical distribution, etc.

[0105] In the specific implementation, the rules for the specified fraud scenarios are first defined, such as: multiple small transactions, cross-regional transactions, etc. Then, according to the rules of the fraud scenarios, the large language model is called to dynamically adjust the generated virtual fraud samples to obtain virtual fraud samples that match the specified fraud scenarios. In order to ensure that the dynamically adjusted virtual fraud samples meet the rules of the specified fraud scenarios, it is also necessary to verify whether each obtained virtual fraud sample meets the constraints of the specified fraud scenarios.

[0106] After obtaining a certain number of virtual fraud samples, the virtual fraud samples can be added to the sample set obtained from the existing data to expand the sample set and avoid inaccurate acquisition of distribution characteristics due to sample scarcity.

[0107] Step 402: Perform a slight perturbation on the samples in the sample set to generate adversarial samples.

[0108] In actual implementation, the following formula can be used to generate adversarial samples:

[0109]

[0110] Where: X advis an adversarial sample used to test the robustness of the large language model; X is the input sample, i.e., the sample to be disturbed, such as: a sample obtained from an ordinary fraudulent transaction record, a sample obtained from a normal transaction record, a virtual fraud sample generated in step 401, etc.; ∈ is the disturbance size; is the gradient of the large language model prediction loss function L with respect to the input data X; L(X, y; θ) is the loss function, which represents the error between the predicted value of the large language model and the true label y; y is the true category label of the input sample X; θ is the parameter set of the large language model.

[0111] Step 403: Use adversarial samples to detect the evaluation model, optimize the large language model according to the detection results, and use the optimized large language model to re-establish the evaluation model to generate a more accurate evaluation model.

[0112] After generating adversarial samples, you can use them to test the semantic parsing ability of the existing large language model, and optimize the semantic parsing logic of the large language model based on the test results.

[0113] After steps 401 to 403 provided in this embodiment, sample expansion and detection optimization of a large language model can be completed.

[0114] The financial fraud risk evaluation method provided in this embodiment is mainly aimed at the three key links of automatic identification of variable characteristics, data distribution and outlier analysis, and sample enhancement in the evaluation model construction process for in-depth optimization. By utilizing the semantic understanding and generation capabilities of the large language model for data, it can intelligently parse complex business variables, automatically extract features and identify potential risk characteristics; through the anomaly analysis method, accurately obtain anomaly detection rules that conform to data characteristics; and design a dynamic sample enhancement mechanism, through virtual fraud sample generation, dynamic adjustment of specified scenarios and adversarial sample testing, to achieve diversified expansion of training samples and comprehensive improvement of large language model capabilities. Through the automation of the analysis process, the refinement of data processing and the intelligence of sample generation, it effectively solves the problems of high manual intervention, complex processes, and insufficient samples in the construction of traditional financial fraud risk models, and provides an efficient and intelligent technical solution for financial risk management, which has significant innovation value and broad application prospects.

[0115] Embodiment 2:

[0116] Based on the financial fraud risk evaluation method provided in the above embodiment 1, the present invention also provides a financial fraud risk evaluation device that can be used to implement the above method, such as Figure 7 , which is a schematic diagram of the device architecture of an embodiment of the present invention. The financial fraud risk assessment device of this embodiment includes one or more processors 11 and a memory 12. Figure 7A processor 11 is taken as an example.

[0117] The processor 11 and the memory 12 may be connected via a bus or other means. Figure 7 The example of connecting through bus is taken in the following.

[0118] The memory 12 is a non-volatile computer-readable storage medium for a method for evaluating financial fraud risk, and can be used to store non-volatile software programs, non-volatile computer executable programs and modules, such as the method for evaluating financial fraud risk in Example 1. The processor 11 executes various functional applications and data processing of the device for evaluating financial fraud risk by running the non-volatile software programs, instructions and modules stored in the memory 12, that is, implements the method for evaluating financial fraud risk in Example 1.

[0119] The memory 12 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage devices. In some embodiments, the memory 12 may optionally include a memory remotely arranged relative to the processor 11, and these remote memories may be connected to the processor 11 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0120] The program instructions / modules are stored in the memory 12, and when executed by one or more processors 11, the financial fraud risk assessment method in the above embodiment 1 is executed, for example, the above described Figure 1 , Figure 2 , Figure 4 and Figure 6 The steps shown.

[0121] An embodiment of the present invention further provides a non-volatile computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are executed by one or more processors, such as Figure 7 A processor 11 in the embodiment can enable the one or more processors to execute the financial fraud risk evaluation method in embodiment 1, for example, to execute the above-described Figure 1 , Figure 2 , Figure 4 and Figure 6 The steps shown.

[0122] It is worth noting that the information interaction, execution process, etc. between the modules and units within the above-mentioned devices and systems are based on the same concept as the processing method embodiment of the present invention. The specific contents can be found in the description of the method embodiment of the present invention and will not be repeated here.

[0123] A person skilled in the art may understand that all or part of the steps in the various methods of the embodiments may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the storage medium may include: a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0124] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for evaluating financial fraud risk, characterized in that: include: Use a large language model to perform semantic analysis on samples to obtain the business semantics of the samples, and obtain the potential risk characteristics and recommended analysis methods for each variable in the samples based on the business semantics; Use a large language model to generate the distribution characteristics of each variable in the sample, and obtain anomaly detection rules for each variable based on potential risk characteristics and distribution characteristics; An evaluation model is established based on potential risk characteristics and anomaly detection rules, and the evaluation model is used to evaluate the data to be analyzed according to the recommended analysis method.

2. The method for evaluating financial fraud risk according to claim 1, characterized in that: The use of a large language model to perform semantic analysis on the sample to obtain the business semantics of the sample, and obtaining the potential risk characteristics and recommended analysis methods of each variable in the sample based on the business semantics, specifically includes: Use a large language model to perform semantic analysis on the sample to obtain a feature vector for each variable in the sample; the feature vector includes data type, distribution characteristics, and business semantics; Match the feature vector with the knowledge base of the corresponding field to obtain the risk score of each variable; Get potential risk characteristics based on risk scores and business semantics, and get recommended analysis methods based on data type and distribution characteristics.

3. The method for evaluating financial fraud risk according to claim 2, characterized in that: The step of obtaining the risk score of each variable specifically includes calculating the risk score using the following formula: Among them, VURI (υ i ) is the variable υ i The risk score, υ i is the variable currently used for risk scoring; γ and ζ are constants used to adjust the risk score; δ(υ i ) is the variable υ i The outlier index relative to other variables, η is the offset constant to ensure the stability of the calculation; λ(υ i ) is the variable υ i The strength assessment value of the corresponding data type; ξ is the matching weight of the matching items in the knowledge base of the corresponding field to the overall risk; is a matching function, the return value of the matching function is the variable υ i The matching strength in the knowledge base of the corresponding domain, It is a knowledge base in the corresponding field.

4. The method for evaluating financial fraud risk according to claim 1, characterized in that: Before using the large language model to generate the distribution characteristics of each variable in the sample, the method further includes: Obtaining original data from data files and metadata information, calculating the harmony of the original data, cleaning the original data according to the harmony, and using the cleaned data as samples; The following formula is used to calculate the harmony of the original data: Where DHI is the harmony of the original data; n is the total number of original data; x i is the i-th sample in the original data set; φ is the adjustment item for the business corresponding to the variable; θ is a constant used to adjust the harmony metric level; ψ is used to emphasize the sample x i The power coefficient of the degree of influence in harmony.

5. The method for evaluating financial fraud risk according to claim 1, characterized in that: The use of a large language model to generate the distribution characteristics of each variable in the sample specifically includes: Use a large language model to parse the variable name and business semantics of each sample, and perform statistics on the samples based on the variable name and business semantics to obtain the skewness and peak of each variable, and obtain the distribution characteristics of each variable based on the skewness and peak.

6. The method for evaluating financial fraud risk according to claim 1, characterized in that: The abnormality detection rules for each variable are obtained according to the potential risk characteristics and distribution characteristics, specifically including: Obtain the abnormal value interval of each variable according to the potential risk characteristics and distribution characteristics; Obtain anomaly detection rules for each variable based on the anomaly value interval and business semantics.

7. The method for evaluating financial fraud risk according to claim 1, characterized in that: According to the recommended analysis method, the evaluation model is used to evaluate the data to be analyzed, including: The business semantics of each variable in the data to be analyzed is obtained through the large language model, and the variables are compared with the anomaly detection rules in the evaluation model according to the recommended analysis method corresponding to the business semantics; If at least one type of variable meets the anomaly detection rules, the data to be analyzed is at high risk; If no variable of any type meets the anomaly detection rules, the data to be analyzed does not have high risk.

8. The method for evaluating financial fraud risk according to claim 1, characterized in that: After the evaluation model is established based on the potential risk characteristics and the anomaly detection rules, the following steps are also included: Based on historical fraud samples and specified fraud scenarios, a large language model is used to generate virtual fraud samples, and the virtual fraud samples are added to the sample set; Make slight perturbations to samples in the sample set to generate adversarial samples; The evaluation model is tested using adversarial samples, the large language model is optimized based on the test results, and the evaluation model is rebuilt using the optimized large language model to generate a more accurate evaluation model.

9. A financial fraud risk assessment device, characterized in that: It includes at least one processor and a memory, the at least one processor and the memory are connected via a data bus, the memory stores instructions that can be executed by the at least one processor, and the instructions, after being executed by the processor, are used to complete the financial fraud risk assessment method described in any one of claims 1-8.

10. A non-volatile computer storage medium, characterized in that: The computer storage medium stores computer executable instructions, which are executed by one or more processors to complete the financial fraud risk assessment method as described in any one of claims 1-8.

Images